# Dns Audit

> Audit a domain's DNS records — MX, SPF, DKIM, DMARC, CAA, A/AAAA — for correctness and best-practice. Use when onboarding a new domain or when an email-deliverability or SSL issue surfaces.

- Skill: `jezweb/dns-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jezweb/dns-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jezweb/dns-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: jezweb (https://skillmd.com/u/jezweb)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jezweb/dns-audit

---


# DNS audit

Comprehensive DNS record audit, producing a structured report + an action list.

## Inputs

- Domain name
- Expected email provider (Google Workspace, Microsoft 365, SMTP2Go, etc.)
- Whether the domain should accept email at all

## Checks

| Record | Check | Best practice |
|---|---|---|
| A / AAAA | Resolves? TTL sensible? | TTL 300-3600 for active, 86400 for stable |
| MX | Matches expected provider? Priority correct? | One primary, optional secondary |
| SPF | Present? Provider includes correct? Ends with `~all` or `-all`? | `-all` preferred for production |
| DKIM | Selector(s) for provider? Key length 2048? | 2048-bit RSA |
| DMARC | Present? `p=quarantine` or `p=reject`? rua/ruf set? | `p=quarantine; sp=quarantine; rua=mailto:...` |
| CAA | Limits cert issuers? | At least lets-encrypt + the active provider |
| NS | Matches expected registrar? | All NS records match |

## Output

`wiki/properties/websites/<domain>/audit-<date>.md` with:

```yaml
---
kind: dns-audit
domain: <domain>
audited_on: <date>
overall: pass | warn | fail
---

## Summary
[2-3 lines]

## Findings
[Per-record check result; flag warnings + failures]

## Actions
[Concrete fixes, ranked by urgency]
```

## Anti-patterns

- Reporting "all good" without checking each record
- Recommending `p=reject` on DMARC for domains that haven't been monitored at `p=none` first
- Removing SPF without verifying current email senders